Alaska State Legislature

Home
Bill & Laws
Bills
HCS CSSB 169(FIN) am H Detail
FullText

txt

HCS CSSB 169(FIN) am H: "An Act relating to release of information in individual workers' compensation records; relating to breaches of security involving personal information, credit report and credit score security freezes, consumer credit monitoring, credit accuracy, protection of social security numbers, disposal of records, identity theft, furnishing consumer credit header information, credit cards, and debit cards; amending Rule 60, Alaska Rules of Civil Procedure; and providing for an effective date."

00 HOUSE CS FOR CS FOR SENATE BILL NO. 169(FIN) am H 01 "An Act relating to release of information in individual workers' compensation records; 02 relating to breaches of security involving personal information, credit report and credit 03 score security freezes, consumer credit monitoring, credit accuracy, protection of social 04 security numbers, disposal of records, identity theft, furnishing consumer credit header 05 information, credit cards, and debit cards; amending Rule 60, Alaska Rules of Civil 06 Procedure; and providing for an effective date." 07 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF ALASKA: 08 * Section 1. AS 23.30.107(b) is amended to read: 09 (b) Medical or rehabilitation records, and the employee's name, address, 10 social security number, and telephone number contained on any record, in an 11 employee's file maintained by the division or held by the board are not public records 12 subject to public inspection and copying under AS 40.25. This subsection does not 13 prohibit

01 (1) the reemployment benefits administrator, the division, the board, or 02 the department from releasing medical or rehabilitation records in an employee's file, 03 without the employee's consent, to a physician providing medical services under 04 AS 23.30.095(k) or 23.30.110(g), a party to a claim filed by the employee, or a 05 governmental agency; or 06 (2) the quoting or discussing of medical or rehabilitation records 07 contained in an employee's file during a hearing on a claim for compensation or in a 08 decision and order of the board. 09 * Sec. 2. AS 23.30.107 is amended by adding a new subsection to read: 10 (d) An employee may elect to authorize the disclosure of the employee's 11 name, address, social security number, and telephone number contained in a record 12 described in (b) of this section by signing a declaration on a form provided by the 13 division. 14 * Sec. 3. AS 40.21.110 is amended to read: 15 Sec. 40.21.110. Care of records. Except for public records lawfully in the 16 possession of a person other than the state, public records of existing or defunct 17 agencies of the state, territorial, and Russian governments in Alaska are the property 18 of the state and shall be created, maintained, preserved, stored, transferred, destroyed 19 or disposed of, and otherwise managed in accordance with the provisions of this 20 chapter and AS 45.48.500 - 45.48.530. Records shall be delivered by outgoing 21 officials and employees to their successors, and may not be removed, destroyed or 22 disposed of, except as provided in this chapter and AS 45.48.500 - 45.48.530. 23 * Sec. 4. AS 44.64.030(a) is amended by adding a new paragraph to read: 24 (35) AS 45.48.060(c) (breach of security involving personal 25 information). 26 * Sec. 5. AS 45 is amended by adding a new chapter to read: 27 Chapter 48. Personal Information Protection Act. 28 Article 1. Breach of Security Involving Personal Information. 29 Sec. 45.48.010. Disclosure of breach of security. (a) If a person owns or uses 30 personal information that includes personal information on a state resident, and a 31 breach of the security of the information system containing the personal information

01 occurs, the person shall, after discovering or being notified of the breach, disclose the 02 breach to each state resident whose personal information was subject to the breach. 03 (b) An information collector shall make the disclosure required by (a) of this 04 section in the most expeditious time possible and without unreasonable delay, except 05 as provided in AS 45.48.020 and as necessary to determine the scope of the breach and 06 restore the reasonable integrity of the information system. 07 Sec. 45.48.020. Allowable delay in notification. An information collector 08 may delay disclosing the breach under AS 45.48.010 if an appropriate law 09 enforcement agency determines that disclosing the breach will interfere with a 10 criminal investigation. However, the information collector shall disclose the breach to 11 the state resident in the most expeditious time possible and without unreasonable delay 12 after the law enforcement agency informs the information collector in writing that 13 disclosure of the breach will no longer interfere with the investigation 14 Sec. 45.48.030. Methods of notice. An information collector shall make the 15 disclosure required by AS 45.48.010 16 (1) by a written document sent to the most recent address the 17 information collector has for the state resident; 18 (2) by electronic means if making the disclosure by the electronic 19 means is consistent with the provisions regarding electronic records and signatures 20 required for notices legally required to be in writing under 15 U.S.C. 7001 et seq. 21 (Electronic Signatures in Global and National Commerce Act); or 22 (3) if the information collector demonstrates that the cost of providing 23 notice would exceed $250,000, that the affected class of state residents to be notified 24 exceeds 500,000, or that the information collector does not have sufficient contact 25 information to provide notice, by 26 (A) electronic mail if the information collector has an 27 electronic mail address for the state resident; 28 (B) conspicuously posting the disclosure on the Internet 29 website of the information collector if the information collector maintains an 30 Internet site; and 31 (C) providing a notice to major statewide media.

01 Sec. 45.48.040. Notification of certain other agencies. (a) If an information 02 collector is required by AS 45.48.010 to notify more than 1,000 state residents of a 03 breach, the information collector shall also notify without unreasonable delay all 04 consumer reporting agencies that compile and maintain files on consumers on a 05 nationwide basis and provide the agencies with the timing, distribution, and content of 06 the notices. 07 (b) This section may not be construed to require the information collector to 08 provide the consumer reporting agencies identified under (a) of this section with the 09 names or other personal information of the state residents whose personal information 10 was subject to the breach. 11 (c) This section does not apply to an information collector who is subject to 15 12 U.S.C. 6801 - 6827 (Gramm-Leach-Bliley Financial Modernization Act). 13 (d) In this section, "consumer reporting agency that compiles and maintains 14 files on consumers on a nationwide basis" has the meaning given in 15 U.S.C. 15 1681a(p). 16 Sec. 45.48.050. Exception for employees and agents. In AS 45.48.010 - 17 45.48.090, the good faith acquisition of personal information by an employee or agent 18 of an information collector for a legitimate purpose of the information collector is not 19 a breach of the security of the information system if the employee or agent does not 20 use the personal information for a purpose unrelated to a legitimate purpose of the 21 information collector and does not make further unauthorized disclosure of the 22 personal information. 23 Sec. 45.48.060. Waivers. A waiver of AS 45.48.010 - 45.48.090 is void and 24 unenforceable. 25 Sec. 45.48.070. Treatment of certain breaches. (a) If a breach of the security 26 of the information system containing personal information on a state resident that is 27 maintained by an information recipient occurs, the information recipient is not 28 required to comply with AS 45.48.010 - 45.48.030. However, immediately after the 29 information recipient discovers the breach, the information recipient shall notify the 30 information distributor who owns the personal information or who licensed the use of 31 the personal information to the information recipient about the breach and cooperate

01 with the information distributor as necessary to allow the information distributor to 02 comply with (b) of this section. In this subsection, "cooperate" means sharing with the 03 information distributor information relevant to the breach, except for confidential 04 business information or trade secrets. 05 (b) If an information recipient notifies an information distributor of a breach 06 under (a) of this section, the information distributor shall comply with AS 45.48.010 - 07 45.48.030 as if the breach occurred to the information system maintained by the 08 information distributor. 09 Sec. 45.48.080. Violations. (a) If an information collector who is a 10 governmental agency violates AS 45.48.010 - 45.48.090 with regard to the personal 11 information of a state resident, the information collector 12 (1) is liable to the state for a civil penalty of up to $500 for each state 13 resident who was not notified under AS 45.48.010 - 45.48.090, but the total civil 14 penalty may not exceed $50,000; and 15 (2) may be enjoined from further violations. 16 (b) If an information collector who is not a governmental agency violates 17 AS 45.48.010 - 45.48.090 with regard to the personal information of a state resident, 18 the violation is an unfair or deceptive act or practice under AS 45.50.471 - 45.50.561. 19 However, the information collector is not subject to the civil penalties imposed under 20 AS 45.50.551 but is liable to the state for a civil penalty of up to $500 for each state 21 resident who was not notified under AS 45.48.010 - 45.48.090, except that the total 22 civil penalty may not exceed $50,000. 23 (c) The Department of Administration may enforce (a) of this section against a 24 governmental agency. The procedure for review of an order or action of the 25 department under this subsection is the same as the procedure provided by AS 44.62 26 (Administrative Procedure Act), except that the office of administrative hearings 27 (AS 44.64.010) shall conduct the hearings in contested cases and the decision may be 28 appealed under AS 44.64.030(c). 29 (d) In this section, "governmental agency" means a state or local governmental 30 agency, except for an agency of the judicial branch. 31 Sec. 45.48.090. Definitions. In AS 45.48.010 - 45.48.090,

01 (1) "breach of the security" means unauthorized acquisition, or 02 reasonable belief of unauthorized acquisition, of personal information that 03 compromises the security, confidentiality, or integrity of the personal information 04 maintained by the information collector; in this paragraph, "acquisition" includes 05 acquisition by 06 (A) photocopying, facsimile, or other paper-based method; 07 (B) a device, including a computer, that can read, write, or 08 store information that is represented in numerical form; or 09 (C) a method not identified by (A) or (B) of this paragraph; 10 (2) "information collector" means a person who owns or uses personal 11 information in any form if the personal information includes personal information on a 12 state resident; 13 (3) "information distributor" means a person who is an information 14 collector and who owns or licenses personal information to an information recipient; 15 (4) "information recipient" means a person who is an information 16 collector but who does not own or have the right to license to another information 17 collector the personal information received by the person from an information 18 distributor; 19 (5) "personal information" means information in any form on an 20 individual that is not encrypted or redacted, or is encrypted and the encryption key has 21 been accessed or acquired, and that consists of a combination of 22 (A) an individual's name, address, or telephone number; in this 23 subparagraph, "individual's name" means a combination of an individual's 24 (i) first name or first initial; and 25 (ii) last name; and 26 (B) one or more of the following information elements: 27 (i) the individual's social security number; 28 (ii) the individual's driver's license number or state 29 identification card number; 30 (iii) the individual's account number, credit card 31 account number, or debit card account number;

01 (iv) account passwords or personal identification 02 numbers or other access codes. 03 Article 2. Credit Report and Credit Score Security Freeze. 04 Sec. 45.48.100. Security freeze authorized. A consumer may prohibit a 05 consumer credit reporting agency from releasing all or a part of the consumer's credit 06 report or credit score without the express authorization of the consumer by placing a 07 security freeze on the consumer's credit report. 08 Sec. 45.48.110. Placement of security freeze. (a) To place a security freeze, a 09 consumer shall make the request to the consumer credit reporting agency 10 (1) by certified mail to the address designated by the consumer credit 11 reporting agency to receive security freeze requests; or 12 (2) as allowed by (b) of this section. 13 (b) A consumer may make a request under (a) of this section by telephone or 14 by fax, the Internet, or other electronic media if the consumer credit reporting agency 15 has developed procedures for using the telephone or an electronic medium to receive 16 and process the request in an expedited manner. 17 (c) A consumer credit reporting agency shall place a security freeze within 18 five business days after receiving a request under (a) or (b) of this section and proper 19 identification from the consumer. 20 Sec. 45.48.120. Confirmation of security freeze. (a) Within 10 business days 21 after a consumer makes the request under AS 45.48.110, a consumer credit reporting 22 agency shall send a written confirmation of the placement of the security freeze to the 23 consumer. 24 (b) At the same time that the consumer credit reporting agency sends a 25 confirmation under (a) of this section, the consumer credit reporting agency shall 26 provide the consumer with a unique personal identification number, password, or 27 similar device to be used by the consumer when the consumer authorizes the release of 28 the consumer's credit report or credit score under AS 45.48.130. 29 Sec. 45.48.130. Access and actions during security freeze. (a) While a 30 security freeze is in place, a consumer credit reporting agency shall allow a third party 31 access to a consumer's credit report or credit score if the consumer requests that the

01 consumer credit reporting agency allow the access. 02 (b) To make a request under (a) of this section, the consumer shall contact the 03 consumer credit reporting agency by certified mail to the address designated by the 04 consumer credit reporting agency to receive security freeze requests or as allowed by 05 (c) of this section, authorize the consumer credit reporting agency to allow the access, 06 and provide the consumer credit reporting agency with 07 (1) proper identification to verify the consumer's identity; 08 (2) the unique personal identification number, password, or similar 09 device provided under AS 45.48.120(b); and 10 (3) the proper information necessary to identify the third party to 11 whom the consumer credit reporting agency may allow the access or the time period 12 during which the consumer credit reporting agency may allow the access to third 13 parties who request the access. 14 (c) In addition to certified mail, a consumer may make a request under (a) of 15 this section by telephone or by fax, the Internet, or other electronic media if the 16 consumer credit reporting agency has developed procedures for using the telephone or 17 an electronic medium to receive and process the request in an expedited manner. 18 (d) A consumer credit reporting agency that receives a request from a 19 consumer under (b) or (c) of this section shall comply with the request immediately 20 after receiving the request by telephone or by an electronic medium or within three 21 business days after receiving the request by certified mail. 22 (e) If a security freeze is in place, a consumer credit reporting agency may not 23 release the credit report or credit score to a third party without the prior express 24 authorization of the consumer. 25 (f) If a security freeze is in place on a consumer's credit report and credit score 26 and if a third party applies to a consumer credit reporting agency to provide the third 27 party with access to the consumer's credit report or credit score, the consumer credit 28 reporting agency and, except as provided for insurers under (g) of this section, the 29 third party may treat the third party's application as incomplete unless the consumer 30 authorizes the access under (a) of this section. 31 (g) If an insurer requests access to a consumer report on which a security

01 freeze is in place, unless the consumer authorizes access under (a) of this section, the 02 insurer may, notwithstanding AS 21.36.460, 03 (1) treat the consumer's application as incomplete; 04 (2) decline the consumer's application if the consumer does not lift the 05 security freeze for the insurer after a request by the insurer or the insurer's agent; 06 (3) treat the consumer as if the consumer has a neutral credit rating; 07 (4) exclude the use of credit information as a factor and use only 08 underwriting criteria; or 09 (5) treat the consumer in a manner that is otherwise approved by the 10 division of insurance. 11 (h) If a security freeze is in place, a consumer credit reporting agency may not 12 change the consumer's official information in the credit report without sending a 13 written statement of the change to the consumer within 30 days after the change is 14 made. A consumer credit reporting agency is not required to send a written statement 15 if the consumer credit reporting agency makes a technical change in the consumer's 16 official information. If a consumer credit reporting agency makes a change, other than 17 a technical change, in a consumer's address, the consumer credit reporting agency 18 shall send the written statement to the consumer at both the new address and the 19 former address. In this subsection, 20 (1) "official information" means name, birth date, social security 21 number, and address; 22 (2) "technical change" means changing spelling, transposing numbers 23 or letters, abbreviating a word, or spelling out an abbreviation. 24 (i) This section is not intended to prevent a consumer credit reporting agency 25 from advising a third party that requests access to a consumer's credit report or credit 26 score that a security freeze is in effect. 27 (j) The procedures used by a consumer credit reporting agency for 28 implementing the provisions of this section may include the use of telephone, 29 facsimile, or electronic means if making the disclosure by the electronic means is 30 consistent with the provisions regarding electronic records and signatures required for 31 notices legally required to be in writing under 15 U.S.C. 7001 et seq. (Electronic

01 Signatures in Global and National Commerce Act), Internet, electronic mail, or 02 another electronic method. 03 Sec. 45.48.140. Removal of security freeze. (a) Except as provided by 04 AS 45.48.130, a consumer credit reporting agency may not remove a security freeze 05 unless 06 (1) the consumer requests that the consumer credit reporting agency 07 remove the security freeze under (b) of this section; or 08 (2) the consumer made a material misrepresentation of fact to the 09 consumer credit reporting agency when the consumer requested the security freeze 10 under AS 45.48.110; if a consumer credit reporting agency intends to remove a 11 security freeze on a consumer's credit report under this paragraph, the consumer credit 12 reporting agency shall notify the consumer in writing before removing the security 13 freeze. 14 (b) A consumer credit reporting agency shall remove a security freeze 15 immediately after receiving a request for removal from the consumer who requested 16 the security freeze. 17 (c) To make a request under (b) of this section, the consumer shall contact the 18 consumer credit reporting agency by certified mail or as allowed by (d) of this section, 19 authorize the consumer credit reporting agency to remove the security freeze, and 20 provide the consumer credit reporting agency with 21 (1) proper identification to verify the consumer's identity; and 22 (2) the unique personal identification number, password, or similar 23 device provided under AS 45.48.120(b). 24 (d) In addition to certified mail, a consumer may make a request under (b) of 25 this section by telephone or by fax, the Internet, or other electronic media if the 26 consumer credit reporting agency has developed procedures for using the telephone or 27 an electronic medium to receive and process the request in an expedited manner. 28 Sec. 45.48.150. Prohibition. When dealing with a third party, a consumer 29 credit reporting agency may not suggest, state, or imply that a consumer's security 30 freeze reflects a negative credit score, history, report, or rating. 31 Sec. 45.48.160. Charges. (a) Except as provided by (b) of this section, a

01 consumer credit reporting agency may not charge a consumer to place or remove a 02 security freeze, to provide access under AS 45.48.130, or to take any other action, 03 including the issuance of a personal identification number, password, or similar device 04 under AS 45.48.120, that is related to the placement of, removal of, or allowing access 05 to a credit report or credit score on which a security freeze has been placed. 06 (b) If a consumer fails to retain a personal identification number, password, or 07 similar device issued under AS 45.48.120, a consumer credit reporting agency may 08 charge the consumer up to $5 for each time after the first time that the consumer credit 09 reporting agency issues the consumer another personal identification number, 10 password, or similar device because the consumer failed to retain the personal 11 identification number, password, or similar device. 12 Sec. 45.48.170. Notice of rights. When a consumer credit reporting agency is 13 required to give a consumer a summary of rights under 15 U.S.C. 1681g (Fair Credit 14 Reporting Act), a consumer credit reporting agency shall also give the consumer the 15 following notice: 16 Consumers Have the Right to Obtain a Security Freeze 17 You may obtain a security freeze on your credit report and 18 credit score at no charge to protect your privacy and ensure that credit 19 is not granted in your name without your knowledge. You have a right 20 to place a "security freeze" on your credit report and credit score under 21 state law (AS 45.48.100 - 45.48.290). 22 The security freeze will prohibit a consumer credit reporting 23 agency from releasing your credit score and any information in your 24 credit report without your express authorization or approval. 25 The security freeze is designed to prevent credit, loans, and 26 other services from being approved in your name without your consent. 27 However, you should be aware that using a security freeze to take 28 control over who gets access to the personal and financial information 29 in your credit report and credit score may delay, interfere with, or 30 prohibit the timely approval of any subsequent request or application 31 you make regarding a new loan, credit, a mortgage, a governmental

01 service, a governmental payment, rental housing, employment, an 02 investment, a license, a cellular phone, a utility, a digital signature, an 03 Internet credit card transaction, an extension of credit at point of sale, 04 and other items and services. 05 When you place a security freeze on your credit report and 06 credit score, within 10 business days you will be provided a personal 07 identification number, password, or similar device to use if you choose 08 to remove the freeze on your credit report and credit score or to 09 temporarily authorize the release of your credit report and credit score 10 to a specific third party or specific third parties or for a specific period 11 of time after the freeze is in place. To provide that authorization, you 12 must contact the consumer credit reporting agency and provide all of 13 the following: 14 (1) proper identification to verify your identity; 15 (2) the personal identification number, password, or 16 similar device provided by the consumer credit reporting agency; 17 (3) proper information necessary to identify the third 18 party or third parties who are authorized to receive the credit report and 19 credit score or the specific period of time for which the credit report 20 and credit score are to be available to third parties. 21 A consumer credit reporting agency that receives your request 22 to temporarily lift a freeze on a credit report and credit score is required 23 to comply with the request immediately after receiving your request if 24 you make the request by telephone, or an electronic method if the 25 agency provides an electronic method, or within three business days 26 after receiving your request if you make the request by certified mail. 27 A security freeze does not apply to circumstances where you 28 have an existing account relationship and a copy of your credit report 29 and credit score are requested by your existing creditor or its agents or 30 affiliates for certain types of account review, collection, fraud control, 31 or similar activities.

01 If you are actively seeking credit, you should understand that 02 the procedures involved in lifting a security freeze may slow your own 03 applications for credit. You should plan ahead and lift a freeze, either 04 completely if you are shopping around, or specifically for a certain 05 creditor, days before actually applying for new credit. 06 You have a right to bring a civil action against someone who 07 violates your rights under these laws on security freezes. The action can 08 be brought against a consumer credit reporting agency. 09 Sec. 45.48.180. Notification after violation. If a consumer credit reporting 10 agency violates a security freeze by releasing a consumer's credit report or credit 11 score, the consumer credit reporting agency shall notify the consumer within five 12 business days after the release, and the information in the notice must include an 13 identification of the information released and of the third party who received the 14 information. 15 Sec. 45.48.190. Violations and penalties. (a) A consumer who suffers 16 damages as a result of a person's violation of AS 45.48.100 - 45.48.290 may bring an 17 action in court against the person and recover, in the case of a violation where the 18 person acted 19 (1) negligently, actual damages, including loss of wages, and, when 20 applicable, damages for pain and suffering; 21 (2) knowingly, 22 (A) damages as described in (1) of this subsection; 23 (B) punitive damages that are not less than $100 nor more than 24 $5,000 for each violation as the court determines to be appropriate; and 25 (C) other relief that the court determines to be appropriate. 26 (b) A consumer may bring an action in court against a person for a violation or 27 threatened violation of AS 45.48.100 - 45.48.290 for injunctive relief, whether or 28 not the consumer seeks another remedy under this section. 29 (c) Notwithstanding (a)(2) of this section, a person who knowingly violates 30 AS 45.48.100 - 45.48.290 is liable in a class action for an amount that the court 31 allows. When determining the amount of an award in a class action under this

01 subsection, the court shall consider, among the relevant factors, the amount of any 02 actual damages awarded, the frequency of the violations, the resources of the violator, 03 and the number of consumers adversely affected. 04 (d) In this section, "knowingly" has the meaning given in AS 11.81.900. 05 Sec. 45.48.200. Exemptions. The provisions of AS 45.48.100 - 45.48.290 do 06 not apply to the use of a credit report by 07 (1) a person, the person's subsidiary, affiliate, or agent, or the person's 08 assignee with whom a consumer has or, before the assignment, had an account, 09 contract, or debtor-creditor relationship if the purpose of the use is to review the 10 consumer's account or to collect a financial obligation owing on the account, contract, 11 or debt; 12 (2) a subsidiary, an affiliate, an agent, an assignee, or a prospective 13 assignee of a person to whom access has been granted under AS 45.48.130 if the 14 purpose of the use is to facilitate the extension of credit or another permissible use; 15 (3) a person acting under a court order, warrant, or subpoena; 16 (4) an agency of a state or municipality that administers a program for 17 establishing and enforcing child support obligations; 18 (5) the Department of Health and Social Services, its agents, or its 19 assigns when investigating fraud; 20 (6) the Department of Revenue, its agents, or its assigns when 21 investigating or collecting delinquent taxes or unpaid court orders or when 22 implementing its other statutory responsibilities; 23 (7) a person if the purpose of the use is prescreening allowed under 15 24 U.S.C. 1681b(c) (Fair Credit Reporting Act); 25 (8) a person administering a credit file monitoring subscription service 26 to which the consumer has subscribed; 27 (9) a person providing a consumer with a copy of the consumer's credit 28 report or credit score at the consumer's request; 29 (10) a consumer credit reporting agency if the data base or file of the 30 consumer credit reporting agency consists entirely of information concerning and used 31 solely for one or more of the following purposes:

01 (A) criminal record information; 02 (B) personal loss history information; 03 (C) fraud prevention or detection; 04 (D) tenant screening; or 05 (E) employment screening. 06 (11) a person who acts only as a reseller of consumer information by 07 assembling and merging information contained in the data bases of consumer credit 08 reporting agencies and does not maintain a permanent data base of consumer 09 information from which new consumer credit reports are produced. 10 Sec. 45.48.290. Definitions. In AS 45.48.100 - 45.48.290, 11 (1) "account review" means activities related to account maintenance, 12 account monitoring, credit line increases, and account upgrades and enhancements; 13 (2) "consumer" means an individual who is the subject of a credit 14 report or credit score; 15 (3) "consumer credit reporting agency" has the meaning given in 16 AS 45.48.990, but does not include a person who issues reports 17 (A) on incidents of fraud or authorizations for the purpose of 18 approving or processing negotiable instruments, electronic funds transfers, or 19 similar methods of payments; or 20 (B) regarding account closures due to fraud, substantial 21 overdrafts, automated teller machine abuse, or similar negative information 22 regarding a consumer to inquiring banks or other financial institutions for use 23 only in reviewing consumer requests for deposit accounts at the inquiring 24 banks or financial institutions; 25 (4) "security freeze" means a prohibition against a consumer credit 26 reporting agency from releasing all or a part of a consumer's credit report or credit 27 score without the express authorization of the consumer; 28 (5) "third party" means a person who is not 29 (A) the consumer who is the subject of the consumer's credit 30 report or credit score; or 31 (B) the consumer credit reporting agency that is holding the

01 consumer's credit report or credit score. 02 Article 3. Consumer Credit Monitoring; Credit Accuracy. 03 Sec. 45.48.300. Required disclosure. A consumer credit reporting agency 04 shall, if a consumer makes the request and the request is not covered by the free 05 disclosure provision of 15 U.S.C. 1681j(a) - (d) (Fair Credit Reporting Act), clearly 06 and accurately disclose to the consumer the information described under 07 AS 45.48.310. 08 Sec. 45.48.310. Information to be disclosed. (a) The following information 09 shall be disclosed under AS 45.48.300: 10 (1) all information in the consumer's file when the consumer makes the 11 request, except that this paragraph may not be construed to require a consumer credit 12 reporting agency to disclose information concerning credit scores, risk scores, or other 13 predictors that are governed by 15 U.S.C. 1681g; 14 (2) the sources of the information described in (1) of this subsection; 15 (3) an identification of each person, including each end user identified 16 under 15 U.S.C. 1681e, who procured a report on the consumer 17 (A) for employment purposes during the two-year period that 18 precedes the date when the consumer's request is made; or 19 (B) for a purpose other than employment purposes during the 20 one-year period that precedes the date when the consumer's request is made; 21 (4) the dates, original payees, and amounts of any checks that 22 (A) provide the basis for an adverse characterization of the 23 consumer; and 24 (B) are included in the file when the disclosure is made or can 25 be inferred from the file; 26 (5) a record of all inquiries that were received by the consumer credit 27 reporting agency during the one-year period that precedes the request and that identify 28 the consumer in connection with a credit or insurance transaction that was not initiated 29 by the consumer; and 30 (6) a statement that the consumer may request and obtain a credit score 31 if the consumer requests the credit file and not the credit score.

01 (b) The information to be disclosed under (a)(3) of this section must include 02 (1) the name of the person or, if applicable, the full trade name under 03 which the person conducts business; and 04 (2) the address and telephone number of the person if requested by the 05 consumer. 06 (c) A consumer credit reporting agency is not required to disclose the 07 information described in (a)(3) of this section if 08 (1) the end user is an agency of the United States government and 09 procures the consumer's credit report from the consumer credit reporting agency to 10 determine the eligibility of the consumer to receive access or continued access to 11 classified information; in this paragraph, "classified information" has the meaning 12 given in 15 U.S.C. 1681b; and 13 (2) the individual who is in charge of the end user makes a written 14 finding as prescribed under 15 U.S.C. 1681b(b)(4)(A). 15 Sec. 45.48.320. Cost of disclosure. (a) A consumer credit reporting agency 16 may impose a reasonable charge on a consumer for making a disclosure under 17 AS 45.48.300. The charge may not exceed 18 (1) $2 for each of the first 12 requests from the consumer in a calendar 19 year; 20 (2) $8 for each request beyond the 12 requests covered by (1) of this 21 subsection in a calendar year. 22 (b) The consumer credit reporting agency shall disclose the charge to the 23 consumer before making the disclosure under AS 45.48.300. 24 Sec. 45.48.330. Form of disclosure. (a) A consumer may make the request 25 under AS 45.48.300 in writing, in person, by telephone if the consumer has made a 26 written request for the disclosure, by electronic means if the consumer credit reporting 27 agency offers electronic access for any other purpose, or by any other reasonable 28 means that is available from the consumer credit reporting agency. 29 (b) To make a request in person under (a) of this section, the consumer shall, 30 after reasonable notice to the consumer credit reporting agency, appear during normal 31 business hours at the consumer credit reporting agency's place of business where the

01 consumer credit reporting agency normally provides disclosures under AS 45.48.300. 02 Sec. 45.48.340. Timing of disclosure. A consumer credit reporting agency 03 shall provide a consumer with the disclosure under AS 45.48.300 within 04 (1) 24 hours after the date on which the request is made if the 05 disclosure is made by electronic means under AS 45.48.330(a); or 06 (2) five days after the date on which the request is made if the 07 disclosure is made in writing, in person, by telephone, or by any other reasonable 08 means that is available from the consumer credit reporting agency, except by 09 electronic means. 10 Sec. 45.48.350. Credit accuracy. (a) A person who does business in the state 11 by distributing information about an individual's credit history, score, or ranking shall, 12 when notified that the information that the person is distributing is inaccurate, 13 immediately stop distributing the information until the accuracy of the information can 14 be verified or the inaccuracies in the information corrected. 15 (b) If a person who does business in the state by distributing information about 16 an individual's credit history, score, or ranking releases information about an 17 individual that is inaccurate, the person shall, as quickly as possible after discovering 18 that inaccurate information is being distributed, 19 (1) repair, to the extent possible, the damage to the individual caused 20 by the release of the inaccurate information; and 21 (2) pay fair and reasonable compensation to the individual for the 22 damage caused to the individual by the release of the inaccurate information. 23 (c) If a person fails to comply with (b) of this section, an individual may bring 24 an action in court to compel the person to comply with (b) of this section. 25 (d) In this section, "does business in the state" means engages in activities that 26 provide at least the minimum contacts required by substantive due process for the state 27 to exercise jurisdiction over the person who is engaging in the activities. 28 Article 4. Protection of Social Security Number. 29 Sec. 45.48.400. Use of social security number. A person may not 30 (1) intentionally communicate or otherwise make available to the 31 general public an individual's social security number;

01 (2) print an individual's social security number on a card required for 02 the individual to access products or services provided by the person; 03 (3) require an individual to transmit the individual's social security 04 number over the Internet unless the Internet connection is secure or the social security 05 number is encrypted; 06 (4) require an individual to use the individual's social security number 07 to access an Internet site unless a password, a unique personal identification number, 08 or another authentication device is also required in order to access the site; or 09 (5) print an individual's social security number on material that is 10 mailed to the individual unless 11 (A) local, state, or federal law, including a regulation adopted 12 under AS 45.48.470, expressly authorizes placement of the social security 13 number on the material; or 14 (B) the social security number is included on an application or 15 other form, including a document sent as a part of an application process or an 16 enrollment process, sent by mail to establish, amend, or terminate an account, a 17 contract, or a policy, or to confirm the accuracy of the social security number; 18 however, a social security number allowed to be mailed under this 19 subparagraph may not be printed, in whole or in part, on a postcard or other 20 mailer that does not require an envelope, or in a manner that makes the social 21 security number visible on the envelope or without the envelope's being 22 opened. 23 Sec. 45.48.410. Request and collection. (a) A person who does business in the 24 state, including the business of government, may not request or collect an individual's 25 social security number. This subsection does not prohibit a person from asking for 26 another form of identification from the individual. 27 (b) The prohibition in (a) of this section does not apply 28 (1) if the person is expressly authorized by local, state, or federal law, 29 including a regulation adopted under AS 45.48.470, to demand proof of the 30 individual's social security number, to collect the individual's social security number, 31 or to submit the individual's social security number to the local, state, or federal

01 government; 02 (2) to a financial institution that is regulated by 15 U.S.C. 6801 - 6827 03 (Gramm-Leach-Bliley Financial Modernization Act) if the financial institution 04 requests or collects the individual's social security number to facilitate a transaction of 05 the individual; 06 (3) to a communication to or from a consumer reporting agency; in this 07 paragraph, "consumer reporting agency" has the meaning given in 15 U.S.C. 1681a 08 (Fair Credit Reporting Act); or 09 (4) if the request or collection is for a background check on the 10 individual, law enforcement purposes, or the individual's employment, including 11 employment benefits. 12 Sec. 45.48.420. Sale, lease, loan, trade, or rental. (a) A person may not sell, 13 lease, loan, trade, or rent an individual's social security number to a third party. 14 (b) The prohibition in (a) of this section does not apply if the sale, lease, loan, 15 trade, or rental is 16 (1) expressly authorized by local, state, or federal law, including a 17 regulation adopted under AS 45.48.470; 18 (2) part of a report prepared by a consumer credit reporting agency in 19 response to a request by a person and the person submits the social security number as 20 part of the request to the consumer credit reporting agency for the preparation of the 21 report. 22 Sec. 45.48.430. Disclosure. (a) A person doing business including the business 23 of government, may not disclose an individual's social security number to a third 24 party. 25 (b) The prohibition in (a) of this section does not apply if 26 (1) the disclosure is expressly authorized by local, state, or federal law, 27 including a regulation adopted under AS 45.48.470; 28 (2) the third party is a financial institution that is regulated by 15 29 U.S.C. 6801 - 6827 (Gramm-Leach-Bliley Financial Modernization Act), and the 30 disclosure is to facilitate a transaction of the individual; 31 (3) the disclosure is part of a report prepared by a consumer credit

01 reporting agency in response to a request by a person and the person submits the social 02 security number as part of the request to the consumer credit reporting agency for the 03 preparation of the report; or 04 (4) the disclosure is for a background check on the individual, law 05 enforcement purposes, or the individual's employment, including employment 06 benefits. 07 Sec. 45.48.440. Interagency disclosure. Notwithstanding the other provisions 08 of AS 45.48.400 - 45.48.480, a state or local governmental agency may disclose an 09 individual's social security number to another state or local governmental agency or to 10 an agency of the federal government if the disclosure is required in order for the 11 agency to carry out the agency's duties and responsibilities. 12 Sec. 45.48.450. Exception for employees, agents, and independent 13 contractors. (a) Notwithstanding the other provisions of AS 45.48.400 - 45.48.480, a 14 person may disclose an individual's social security number to an employee or agent of 15 the person for a legitimate purpose established by and as directed by the person, but 16 the employee or agent may not use the social security number for another purpose or 17 make an unauthorized disclosure of the individual's personal information. 18 (b) Notwithstanding the other provisions of AS 45.48.400 - 45.48.480, and 19 except as provided for an agent under (a) of this section, a person may disclose an 20 individual's social security number to an independent contractor of the person to 21 facilitate the purpose or transaction for which the individual initially provided the 22 social security number to the person, but the independent contractor may not use the 23 social security number for another purpose or make an unauthorized disclosure of the 24 individual's personal information. 25 Sec. 45.48.460. Employment-related exception. The provisions of 26 AS 45.48.400 - 45.48.480 may not be construed to restrict a person's use or exchange 27 of an individual's social security number 28 (1) in the course of the administration of a claim, benefit, or procedure 29 related to the individual's employment by the person, including the individual's 30 termination from employment, retirement from employment, and injury suffered 31 during the course of employment; or

01 (2) to check on an unemployment insurance claim of the individual. 02 Sec. 45.48.470. Agency regulations. If the regulations are necessary in order 03 for the state agency to carry out the state agency's duties and responsibilities, a state 04 agency may adopt regulations under AS 44.62 (Administrative Procedure Act) to 05 establish when the state agency or a person regulated by the state agency may 06 (1) print an individual's social security number on material that is 07 mailed to the individual; 08 (2) demand proof from an individual of the individual's social security 09 number, collect from an individual the individual's social security number, or submit 10 an individual's social security number to a local, state, or federal agency; 11 (3) ask an individual to provide the state agency with the individual's 12 social security number; 13 (4) disclose an individual's social security number to a third party; 14 (5) sell, lease, loan, trade, or rent an individual's social security number 15 to a third party. 16 Sec. 45.48.480. Penalties. (a) A person who knowingly violates AS 45.48.400 17 - 45.48.430 is liable to the state for a civil penalty not to exceed $3,000. 18 (b) An individual may bring a civil action in court against a person who 19 knowingly violates AS 45.48.400 - 45.48.430 and may recover actual damages or 20 $5,000, whichever amount is greater, and court costs and attorney fees allowed by the 21 rules of court. 22 (c) A person who knowingly violates AS 45.48.400 - 45.48.430 is guilty of a 23 class A misdemeanor. 24 (d) In this section, "knowingly" has the meaning given in AS 11.81.900. 25 Article 5. Disposal of Records. 26 Sec. 45.48.500. Disposal of records. (a) When disposing of records that 27 contain personal information, a business and a governmental agency shall take all 28 reasonable measures necessary to protect against unauthorized access to or use of the 29 records. 30 (b) Notwithstanding (a) of this section, if a business or governmental agency 31 has otherwise complied with the provisions of AS 45.48.500 - 45.48.590 in the

01 selection of a third party engaged in the business of record destruction, the business or 02 governmental agency is not liable for the disposal of records under AS 45.48.500 - 03 45.48.590 after the business or governmental agency has relinquished control of the 04 records to the third party for the destruction of the records. 05 (c) A business or governmental agency is not liable for the disposal of records 06 under AS 45.48.500 - 45.48.590 after the business or governmental agency has 07 relinquished control of the records to the individual to whom the records pertain. 08 Sec. 45.48.510. Measures to protect access. The measures that may be taken 09 to comply with AS 45.48.500 include 10 (1) implementing and monitoring compliance with policies and 11 procedures that require the burning, pulverizing, or shredding of paper documents 12 containing personal information so that the personal information cannot practicably be 13 read or reconstructed; 14 (2) implementing and monitoring compliance with policies and 15 procedures that require the destruction or erasure of electronic media and other 16 nonpaper media containing personal information so that the personal information 17 cannot practicably be read or reconstructed; 18 (3) after due diligence, entering into a written contract with a third 19 party engaged in the business of record destruction to dispose of records containing 20 personal information in a manner consistent with AS 45.48.500 - 45.48.590. 21 Sec. 45.48.520. Due diligence. In AS 45.48.510(3), due diligence ordinarily 22 includes performing one or more of the following: 23 (1) reviewing an independent audit of the third party's operations and 24 its compliance with AS 45.48.500 - 45.48.590; 25 (2) obtaining information about the third party from several references 26 or other reliable sources and requiring that the third party be certified by a recognized 27 trade association or similar organization with a reputation for high standards of quality 28 review; 29 (3) reviewing and evaluating the third party's information security 30 policies and procedures, or taking other appropriate measures to determine the 31 competency and integrity of the third party.

01 Sec. 45.48.530. Policy and procedures. A business or governmental agency 02 shall adopt written policies and procedures that relate to the adequate destruction and 03 proper disposal of records containing personal information and that are consistent with 04 AS 45.48.500 - 45.48.590. 05 Sec. 45.48.540. Exemptions. (a) A business or a governmental agency is not 06 required to comply with AS 45.48.500 - 45.48.530 if federal law requires that the 07 business or governmental agency act in a way that does not comply with AS 45.48.500 08 - 45.48.530. 09 (b) A business is not required to comply with AS 45.48.500 - 45.48.530 if 10 (1) the business is subject to and in compliance with 15 U.S.C. 6801 - 11 6827 (Gramm-Leach-Bliley Financial Modernization Act); or 12 (2) the manner of the disposal of the records of the business is subject 13 to 15 U.S.C. 1681w (Fair Credit Reporting Act) and the business is complying with 15 14 U.S.C. 1861w. 15 Sec. 45.48.550. Civil penalty. An individual, a business, or a governmental 16 agency that knowingly violates AS 45.48.500 - 45.48.590 is liable to the state for a 17 civil penalty not to exceed $3,000. In this section, "knowingly" has the meaning given 18 in AS 11.81.900. 19 Sec. 45.48.560. Court action. An individual who is damaged by a violation of 20 AS 45.48.500 - 45.48.590 may bring a civil action in court to enjoin further violations 21 and to recover damages for the violation and court costs and attorney fees allowed by 22 the rules of court. 23 Sec. 45.48.590. Definitions. In AS 45.48.500 - 45.48.590, 24 (1) "business" means a person who conducts business in the state or a 25 person who conducts business and maintains or otherwise possesses personal 26 information on state residents; in this paragraph, 27 (A) "conducts business" includes engaging in activities as a 28 financial institution organized, chartered, or holding a license or authorization 29 certificate under the laws of this state, another state, the United States, or 30 another country; 31 (B) "possesses" includes possession for the purpose of

01 destruction; 02 (2) "dispose" means 03 (A) the discarding or abandonment of records containing 04 personal information; 05 (B) the sale, donation, discarding, or transfer of 06 (i) any medium, including computer equipment or 07 computer media, that contains records of personal information; 08 (ii) nonpaper media, other than that identified under (i) 09 of this subparagraph, on which records of personal information are 10 stored; and 11 (iii) equipment for nonpaper storage of information; 12 (3) "governmental agency" means a state or local governmental 13 agency, except for an agency of the judicial branch; 14 (4) "personal information" means information that identifies, relates to, 15 describes, or is capable of being associated with a particular individual, and includes a 16 name, signature, social security number, fingerprint, photograph, computerized image, 17 physical characteristic, physical description, address, telephone number, passport 18 number, driver's license, state identification number, date of birth, medical 19 information, bank account number, credit card number, debit card number, and 20 financial information; 21 (5) "records" means material on which information that is written, 22 drawn, spoken, visual, or electromagnetic is recorded or preserved, regardless of 23 physical form or characteristics, but does not include publicly available directories 24 containing names, addresses, telephone numbers, or other information an individual 25 has voluntarily consented to have publicly disseminated or listed. 26 Article 6. Factual Declaration of Innocence after Identity Theft; Right to File Police 27 Report Regarding Identity Theft. 28 Sec. 45.48.600. Factual declaration of innocence after identity theft. (a) A 29 victim of identity theft may petition the superior court for a determination that the 30 victim is factually innocent of a crime if 31 (1) the perpetrator of the identity theft was arrested for, cited for, or

01 convicted of the crime using the victim's identity; 02 (2) a criminal complaint has been filed against the perpetrator in the 03 victim's name; or 04 (3) the victim's identity has been mistakenly associated with a record 05 of a conviction for a crime. 06 (b) In addition to a petition by a victim under (a) of this section, the 07 department may petition the superior court for a determination under (a) of this 08 section, or the superior court may, on its own motion, make a determination under (a) 09 of this section. 10 Sec. 45.48.610. Basis for determination. A determination of factual 11 innocence under AS 45.48.600 may be heard and made on declarations, affidavits, 12 police reports, or other material, relevant, and reliable information submitted by the 13 parties or ordered to be made a part of the record by the court. 14 Sec. 45.48.620. Criteria for determination; court order. (a) A court shall 15 determine that a victim is factually innocent of a crime if the court finds that the 16 petition or motion brought under AS 45.48.600 is meritorious and that 17 (1) there is not a reasonable cause to believe that the victim committed 18 the crime for which the perpetrator of the identity theft was arrested, cited, convicted, 19 or subject to a criminal complaint in the victim's name; or 20 (2) the victim's identity has been mistakenly associated with a record 21 of a conviction of a crime. 22 (b) If a court finds under this section that the victim is factually innocent of a 23 crime, the court shall issue an order indicating this determination of factual innocence 24 and shall provide the victim with a copy of the order. 25 Sec. 45.48.630. Orders regarding records. After a court issues an order under 26 AS 45.48.620, the court may order the name and associated personal information of 27 the victim that is contained in the files, indexes, and other records of the court that are 28 accessible by the public deleted, sealed, or labeled to show that the name and personal 29 information is impersonated and does not reflect the defendant's identity. 30 Sec. 45.48.640. Vacation of determination. A court that has issued an order 31 under AS 45.48.620 may, at any time, vacate the order if the petition or motion, or any

01 information submitted in support of the petition or motion, is found to contain a 02 material misrepresentation or fraudulent material. 03 Sec. 45.48.650. Court form. The supreme court of the state may develop a 04 form to be used for the order under AS 45.48.620. 05 Sec. 45.48.660. Data base. The department may establish and maintain a data 06 base of individuals who have been victims of identity theft and who have received an 07 order under AS 45.48.620. The department shall provide a victim or the victim's 08 authorized representative access to a data base established under this section in order 09 to establish that the individual has been a victim of identity theft. Access to the a data 10 base established under this section is limited to criminal justice agencies, victims of 11 identity theft, and individuals and agencies authorized by the victims. 12 Sec. 45.48.670. Toll-free telephone number. The department may establish 13 and maintain a toll-free telephone number to provide access to information in a data 14 base established under AS 45.48.660. 15 Sec. 45.48.680. Right to file police report regarding identity theft. (a) Even 16 if the local law enforcement agency does not have jurisdiction over the theft of an 17 individual's identity, if an individual who has learned or reasonably suspects the 18 individual has been the victim of identity theft contacts, for the purpose of filing a 19 complaint, a local law enforcement agency that has jurisdiction over the individual's 20 actual place of residence, the local law enforcement agency shall make a report of the 21 matter and provide the individual with a copy of the report. The local law enforcement 22 agency may refer the matter to a law enforcement agency in a different jurisdiction. 23 (b) This section is not intended to interfere with the discretion of a local law 24 enforcement agency to allocate its resources to the investigation of crime. A local law 25 enforcement agency is not required to count a complaint filed under (a) of this section 26 as an open case for purposes that include compiling statistics on its open cases. 27 Sec. 45.48.690. Definitions. In AS 45.48.600 - 45.48.690, 28 (1) "crime" has the meaning given in AS 11.81.900; 29 (2) "department" means the Department of Law; 30 (3) "identity theft" means the theft of the identity of an individual; 31 (4) "perpetrator" means the person who perpetrated the theft of an

01 individual's identity; 02 (5) "victim" means an individual who is the victim of identity theft. 03 Article 7. Consumer Credit Header Information. 04 Sec. 45.48.700. Consumer credit header information. (a) A consumer credit 05 reporting agency may not furnish by a written, an oral, or another method of 06 communication a consumer's credit header information to a person unless 07 (1) the person has a permissible purpose under 15 U.S.C. 1681b (Fair 08 Credit Protection Act) to obtain the consumer's credit report; or 09 (2) the disclosure is part of a report prepared by the consumer credit 10 reporting agency in response to a request by a person and the person submits the social 11 security number as part of the request to the consumer credit reporting agency for the 12 preparation of the report. 13 (b) In this section, "credit header information" means the social security 14 number of a consumer, or a derivative of the social security number, the maiden name 15 of the mother of the consumer, the birth date of the consumer, and other personally 16 identifiable information of a consumer that is derived from nonpublic personal 17 information, except the name, address, and telephone number of the consumer listed in 18 a residential telephone directory available in the locality of the consumer. 19 Article 8. Truncation of Card Information. 20 Sec. 45.48.750. Truncation of card information. (a) A person who accepts 21 credit cards or debit cards for the transaction of business may not print more than the 22 last five digits of the card number or the expiration date on any receipt provided to the 23 cardholder at the point of the sale or transaction. 24 (b) This section applies only to receipts that are electronically printed and does 25 not apply to transactions in which the sole means of recording a credit card or debit 26 card account number is by handwriting or by an imprint or copy of the card. 27 (c) An individual may bring a civil action in court against a person who 28 knowingly violates this section and may recover actual damages or $5,000, whichever 29 is greater, and court costs and attorney fees allowed by the rules of court. 30 (d) A person who knowingly violates this section is liable to the state for a 31 civil penalty not to exceed $3,000.

01 (e) A person who knowingly violates this section is guilty of a class A 02 misdemeanor. 03 (f) In this section, 04 (1) "credit" means the right granted by a creditor to a debtor to defer 05 payment of debt, to incur debts and defer payment of the debt, or to purchase property 06 or services and defer payment of the purchase;in this paragraph, "creditor" means a 07 person who regularly extends, renews, or continues credit, a person who regularly 08 arranges for the extension, renewal, or continuation of credit, or an assignee of an 09 original creditor who participates in the decision to extend, renew, or continue credit; 10 (2) "credit card" means a card, plate, coupon book, or other credit 11 device existing for the purpose of obtaining money, property, labor, or services on 12 credit; 13 (3) "debit card" means a card issued by a financial institution to a 14 consumer for use in initiating an electronic fund transfer from the account of the 15 consumer at the financial institution for the purpose of transferring money between 16 accounts or obtaining money, property, labor, or services; 17 (4) "knowingly" has the meaning given in AS 11.81.900. 18 Article 9. General Provisions. 19 Sec. 45.48.990. Definitions. In this chapter, unless the context indicates 20 otherwise, 21 (1) "consumer" means an individual; 22 (2) "consumer credit reporting agency" means a person who, for 23 monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or 24 in part in the practice of assembling or evaluating consumer credit information or 25 other information on consumers for the purpose of furnishing credit reports to third 26 parties; 27 (3) "credit report" means a written, oral, or other communication of 28 information by a consumer credit reporting agency bearing on a consumer's credit 29 worthiness, credit standing, credit capacity, character, general reputation, personal 30 characteristics, or mode of living if the communication is used or expected to be used 31 or collected in whole or in part to serve as a factor in establishing the consumer's

01 eligibility for 02 (A) credit or insurance to be used primarily for personal, 03 family, or household purposes; 04 (B) employment purposes; or 05 (C) any other permissible purpose authorized under section 15 06 U.S.C. 1681b; 07 (4) "information system" means any information system, including a 08 system consisting of digital data bases and a system consisting of pieces of paper; 09 (5) "person" has the meaning given in AS 01.10.060 and includes a 10 state or local governmental agency, except for an agency of the judicial branch; 11 (6) "state resident" means an individual who satisfies the residency 12 requirements under AS 01.10.055. 13 Sec. 45.48.995. Short title. This chapter may be cited as the Alaska Personal 14 Information Protection Act. 15 * Sec. 6. AS 45.50.471(b) is amended by adding a new paragraph to read: 16 (52) an information collector, other than a governmental agency, 17 violating AS 45.48.010 - 45.48.090 (breach of security involving personal 18 information); in this paragraph, 19 (A) "governmental agency" has the meaning given in 20 AS 45.48.080; 21 (B) "information collector" has the meaning given in 22 AS 45.48.090. 23 * Sec. 7. The uncodified law of the State of Alaska is amended by adding a new section to 24 read: 25 INDIRECT COURT RULE AMENDMENT. AS 45.48.640, enacted by sec. 5 of this 26 Act, has the effect of changing Rule 60(b), Alaska Rules of Civil Procedure, by allowing a 27 court to vacate an order on its own motion and at any time and by establishing a specific 28 criterion for vacating the order under AS 45.48.640. 29 * Sec. 8. Sections 1 and 2 and AS 45.48.470, enacted by sec. 5 of this Act, take effect 30 immediately under AS 01.10.070(c).